Detecting Unknown Network Attacks with Attention Encoding and Deep Metric Learning

Emerging and evolving cybersecurity threats pose significant risks to the private data and assets of government, businesses, and individuals. The timely detection of unknown network attacks is a crucial defense measure to stop cybercrimes. However, the intricate organization and elaborate disguise make the previously unknown attacks hard to pinpoint. In this paper, we propose an approach with an attention encoding and deep metric learning model for intrusion detection. To handle the class-imbalance problem in the training data, we introduced a genetic algorithm-inspired data augmentation, applying the selection-crossover model to generate additional rare-class data. Using the class centers learned by the t-SNE algorithm for the online triplets, we reduced the randomness in the loss function calculation for the Triplet network. The self-attention and channel attention help to find the correlations between the samples and strengthen the mapping power of the low-dimensional metric space. To test the proposed detection system, we used NSL-KDD datasets for evaluation. Compared with the state-of-the-art methods in other research, our system presented a better performance for detecting unknown attacks, with an accuracy of 87% for multi-class classification, improving over 2.8%.